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Abstract. We have previously introduced role logic as a notation for 
describing properties of relational structures in shape analysis, databases 
and knowledge bases. A natural fragment of role logic corresponds to 
two- variable logic with counting and is therefore decidable. 
We show how to use role logic to describe open and closed records, as 
well the dual of records, inverse records. We observe that the spatial 
conjunction operation of separation logic naturally models record con- 
catenation. Moreover, we show how to eliminate the spatial conjunction 
of formulas of quantifier depth one in first-order logic with counting. As 
a result, allowing spatial conjunction of formulas of quantifier depth one 
preserves the decidability of two- variable logic with counting. This result 
applies to two-variable role logic fragment as well. 

The resulting logic smoothly integrates type system and predicate cal- 
culus notation and can be viewed as a natural generalization of the no- 
tation for constraints arising in role analysis and similar shape analysis 
approaches. 
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1 Introduction 

In [36] we have introduced role logic, a notation for describing properties of 
relational structures in shape analysis, databases and knowledge bases. Role 
logic notation aims to combine the simplicity of role declarations [33] and the 
well-established first-order logic. Role logic is closed under all boolean operations 
and generalizes boolean shape analysis constraints [37] . Role logic formulas easily 
translate into the traditional first-order logic notation. Despite this generality 
role logic enables the concise expression of common properties of data structures 
in imperative programs that manipulate complex data structures with mutable 
references. In [36, Section 4] we have established the decidability of the fragment 
RL of role logic by exhibiting a correspondence with two- variable logic with 
counting C 2 [22,45]. 

Generalized records in role logic. In this paper we give a systematic 
account of field and slot declarations of role analysis [33] by introducing a set of 
role logic shorthands that allows concise description of records. Our basic idea 
is to generalize types to unary predicates on objects. Some of the aspects of our 
notion of records that indicate its generality are: 

1. We allow building new records by taking the conjunction, disjunction, or 
negation of records. 

2. In our notation, a record indicates a property of an object at a particular 
program point; objects can satisfy different record specifications at differ- 
ent program points. As a result, our records can express typestate changes 
such as object initialization [16-18,55,56] and more general changes in rela- 
tionships between objects such as movements of objects between data struc- 
tures [32,33,54]. 

3. We allow inverse records as a dual of records that specify incoming edges of 
an object in the graph of objects representing program heap. Inverse records 
allow the specification of aliasing properties of objects, generalizing unique 
pointers. Inverse records enable the convenient specification of movements 
of objects that participate in multiple data structures. 

4. We allow the specification of both open and closed records. Closed records 
specify a complete set of outgoing and incoming edges of an object. Open 
records leave certain edges unspecified, which allows orthogonal data struc- 
tures to be specified independently and then combined using logical conjunc- 
tion. 

5. We allow the concatenation of generalized records using a form of spatial 
conjunction of separation logic, while remaining within the decidable frag- 
ment of two- variable role logic. 

Separation logic. Separation logic [28,43,51,52] is a promising approach for 
specifying properties of programs in the presence of mutable data structures. One 
of the main uses of separation logic in previous approaches is dealing with frame 
conditions [5,28]. In contrast, our paper identifies another use of spatial logic: 
expressing record concatenation. Although our approach is based on essentially 



same logical operation of spatial conjunction, our use of spatial conjunction for 
records is more local, because it applies to the descriptions of the neighborhood 
of an object. 

To remain within the decidable fragment of role logic, we give in Section 7 
a construction that eliminates spatial conjunction when it connects formulas of 
quantifier depth one. This construction also illustrates that spatial conjunction 
is useful for reasoning about counting stars [22] of the two-variable logic with 
counting C 2 . To our knowledge, this is the first result that combines two- variable 
logic with counting and a form of spatial conjunction. 

Using the resulting logic. We can use specifications written in our notation to 
describe properties and relations between objects in programs with dynamically 
allocated data structures. These specifications can act as assertions, precondi- 
tions, postconditions, loop invariants or data structure invariants [33,36,39]. 
By selecting a finite-height lattice of properties for a given program fragment, 
abstract interpretation [15] can be used to synthesize properties of objects at in- 
termediate program points [2,3,24,33,49,50,54,58,59]. Decidability and closure 
properties of our notation are essential for the completeness and predictability 
of the resulting static analysis [38] . 
Contributions. We summarize the main contributions of this paper as follows: 

1 . We present a logic which generalizes the concept of records in several direc- 
tions (Section 5). These generalizations arc useful for expressing properties 
of objects and memory cells in imperative programs, and go beyond standard 
type systems. 

2. We identify a novel use of separation logic: modelling the concatenation of 
generalized records. 

3. We show how to translate role constraints from role analysis [33] to role logic 
(Section 6). 

4. We show that, under certain syntactic restrictions, we can translate spatial 
conjunction into other constructs of the decidable logic RL (Section 7). 
We therefore obtain a notation that extends RL with a convenient way of 
describing record concatenation, and remains decidable. 

5. We present a translation of first-order logic with spatial conjunction and 
inductive definitions into second-order logic (Section 8.2). 

Outline. Section 2 reviews the syntax and semantics of role logic. Section 3 
defines spatial conjunction in role logic and motivates its use for describing record 
concatenation. Section 4 and Section 5 show how to use spatial conjunction in 
role logic to describe a generalization of records. Section 6 demonstrates that our 
notation is a generalization of the local constraints arising in role analysis [33] 
by giving a natural embedding of role constraints into our notation. Section 7 
shows how to eliminate the spatial conjunction connective © from a spatial 
conjunction F\ © F2 of two formulas i*\ and Fi when F\ and Fi have no nested 
counting quantifiers; this is the core technical result of this paper. A consequence 
of this is result is that we may allow certain uses of spatial conjunction in RL 2 
fragment of role logic while preserving the decidability property of RL . Our 



extension of role logic with spatial conjunction is therefore justified: it allows 
record-like specifications to be expressed in a more natural way, and it does not 
lead outside the decidable fragment. Section 8 contains remarks on preserving the 
satisfiability of formulas in the presence of spatial conjunction and shows how to 
encode the spatial conjunction (with inductive definitions) in second-order logic. 
Section 9 presents related work, and Section 10 concludes. Appendix contains 
the details of the correctness proof for the elimination of spatial conjunction 
from Section 7. 

2 A Decidable Two- Variable Role Logic RL 2 



F ::= A\ f \EQ\ Fi AF 2 \ ->F \ F' \ ~F \ card- fc F 

e :: {1,2} - D 

[Aje = [A] (el) [/]e = [/](e 2, e 1) 

[EQ]e = (e2) = (el) 

[Fi A F 2 ]e = ([F^e) A ([F 2 ]e) [-FJe = -([F]e) 

[F']e = [F](e[l~(e2)]) [~F]e = [F](e[l .- (e2),2 ,- (el)]) 

[card^ fe F]e = \{d G D | [F](e[l «o,2^(e 1)])}| > fc 

Fig. 1. The Syntax and the Semantics of RL 2 



Figure 1 presents the two- variable role logic RL [36]. We have proved in [36] 
that RL has the same expressive power as two- variable logic with counting 
C 2 . The logic C 2 is a first-order logic 1) extended with counting quantifiers 
3-x.F(x), saying that there are at least k elements x satisfying formula F(x) 
for some constant k, and 2) restricted to allow only two variable names x, y in 
formulas. An example formula in two-variable logic with counting is 

Vx.A{x) => (Vy.f(x,y) =► 3 =1 x.g(x,y)) (1) 

The formula (1) means that all nodes that satisfy A(x) point along the field / 
to nodes that have exactly one incoming g edge. Note that the variables x and y 
may be reused via quantifier nesting, and that formulas of the form 3 =k x. F(x) 
and 3- k x. F(x) are expressible as boolean combination of formulas of the form 
3- k x.F(x). The logic C 2 was shown decidable in [22] and the complexity for 
the C\ fragment of C 2 (with counting up to one) was established in [45] . We can 
view role logic as a variable- free version of C 2 . Variable- free logical notations are 
attractive as generalizations of type systems because traditional type systems 
are often variable-free. The formula (1) can be written in role logic as [A => 
[/ =>■ card- 1 ^]] where the construct [F] is a shorthand for -card- 1 -^ and 
corresponds to the universal quantifier. The expression ~g denotes the inverse 



of relation g. This paper focuses on the use of role logic to describe generalized 
records, see [36] for further examples of using role logic and [6] for advantages 
of variable-free notation in general. 

3 Spatial Conjunction 



[Fi©F 2 ]e = 3ei,e 2 . split e [ei e 2 ] A [Fijei A [F 2 ]e 2 
split e [ei e 2 ] = 

VAeA.WeD. (eA)d ^^ (ei A) d V (e 2 A) d A -i((ei A) d A (e 2 4) d) A 

Vfef.Vdi,d2 &D. 

(e/)did 2 <^> (ei /) di d 2 V (e 2 /) di d 2 A -i((ei /) di d 2 A (e 2 /) di d 2 ) 

emp = [[ A ~<A A A -/]] 

Ae.4 /e^ 

priority: A binds strongest, then ©, then V 

F ~ G means Ve. [F]e = [G]e 

(F 1 ®F 2 )®F 3 ~ Fi©(F 2 ©F 3 ) 

_F©emp ~ emp©_F ~ F 

Fi©F 2 ~ F 2 ©fi 

Fi ®(F 2 V F 3 ) ~ Fi © F 2 V Fi © F 3 

Fig. 2. Semantics and Properties of Spatial Conjunction ©. 



Figure 2 shows our semantics of spatial conjunction ©. To motivate our use of 
spatial conjunction, we first illustrate how role logic supports the description of 
simple properties of objects in a concise way. Indeed, one of the design goals of 
role logic is to have a logic-based specification language where simple properties 
of objects are as convenient to write as type declarations in a language like Java. 

Example 1. The formula [/ =>• A] is true for an object whose every /-fields points 
to an A object, [g =>■ B] means that every g-field points to a B object, so 

[/ =► A] A [g => B] 

denotes the objects that has both / pointing to an A object and g pointing to a 
B object. Such specification is as concise as the following Java class declaration 

class C { A f ; B g; } 

Example 1 illustrates how the presence of conjunction A in role logic enables 
combination of orthogonal properties such as constraints on distinct fields. How- 
ever, not all properties naturally compose using conjunction. 



Example 2. Consider a program that contains three fields, modelled as binary 
relations /, g, h. The formula Pf = (card - /) A (card - (g V h)) means that 
the object has only one outgoing /-edge and no other edges. The formula P g = 
(card -1 g) A (card -0 (/ V h)) means that the object has only one outgoing g-edge 
and no other edges. If we "physically join" two records, each of which has one 
field, we obtain a record that has two fields, and is described by the formula 

Pf g = (card =1 /) A(card =1 5 ) A (card =0 /i) 

Note that it is not the case that Pf g ~ Pf A P g . More generally, no boolean 
combination of Pf and P g yields Pf g . 

Example 2 prompts the question: is there an operation that allows joining spec- 
ifications that will allow us to combine Pf and P g into -P/ 3 ? Moreover, can we 
define such an operation on records viewed as arbitrary formulas in role logic? 

It turns out that there is a natural way to describe the set of models of formula 
Pf g in Example 2 as the result of "physically merging" the edges (relations) of 
the models of Pf and models of P g . The merging of disjoint models of formulas is 
the idea behind the definition of spatial conjunction © in Figure 2. The predicate 
(split e [ei e2\) is true iff the relations of the model (environment) e can be split 
into ei and ei and the notation generalizes to splitting into any number of 
environments. 

Example 3. For Pf, P gi and Pf g of Example 2, we have Pf g — Pf ®P g . 

Note that the operation © is associative and commutative. The formula emp, 
which asserts that all predicates are false, is the unit for ©. Moreover, © dis- 
tributes over V. 

A note on relationship with [28]. The semantics of spatial conjunction in 
Figure 2 match the semantics of [28], with two differences. 

A small technical difference is that Figure 2 splits the edges of the model 
(the tuples of the relations), whereas [28] splits the domain. The difference arises 
because the elements of the domain in [28] are locations, whereas the elements 
of our models are objects. To represent a location in our view, we would use a 
tuple (o, /) where o is an element of the domain and / is a field name. 

A higher-level difference is that the use of spatial logic we propose in this 
paper is the notation for records (Section 5), as opposed to the description of 
global heap properties. When used for formulas of quantifier depth one (Sec- 
tion 7), spatial conjunction does not even change the set of definable relations 
of two- variable logic with counting. 



4 Field Complement 

As a step towards record calculus in role logic, this section introduces the notion 
of a field complement, which makes it easier to describe records in role logic. 
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Example 4- Consider the formula Pf = (card - /)A(card - (gVh)) from Exam- 
ple 2, stating the property that an object has only one outgoing /-edge and no 
other edges. Property Pf has little to do with g or h, yet g and h explicitly occur 
in Pf. Moreover, we need to know the entire set of relations in the language to 
write Pf: if the language contains an additional field i, the property Pf would 
become Pf = (card - /) A (card - (gV h\J i)). Note also that ->/ is not the same 
as g V h V i, because -■/ computes the complement of the value of the relation / 
with respect to the universal set, whereas g V h V i is the union of all relations 
other than /. 

To address the notational problem illustrated in Example 4, we introduce the 
symbol edges, which denotes the union of all binary relations, and the notation 
— / (field complement of /), which denotes the union of all relations other than 

/•' 

edges = V 9 -f = V 9 

a g±f 

This additional notation allows us to avoid explicitly listing all fields in the 
language when stating properties like Pf. 

Example 5. Formula Pf from Example 4 can be written as Pf = (card -1 /) A 
(card - — /), which mentions only /. Even when the language is extended with 
additional relations, Pf still denotes the intended property. Similarly, to denote 
the property of an object that has outgoing fields given by Pf and has no in- 
coming fields, we use the predicate Pf A card - ^edges. 

We use the notation edges and —/to build the notation for records and inverse 
records in Section 5 below. 

A note on ternary relation interpretation. It is possible to provide a 
notation for relations that generalizes the notation edges and — /. The idea of 
this generalization is to change the definition of the model (environment). Instead 
of a model that specifies a binary relation for each field, the model specifies the 
value of one ternary relation H and a unary tag-predicate for each field name. 
For example, instead of the model that provides interpretations fj and gi for two 
binary relations / and g, we could use the model that provides interpretation of 
[if], where 

{H]o 1 o 2 n = (n=/ A//O1O2) V 

(n=g A. /1O1O2) 

and the interpretation of unary tag-predicates / and g. Here /o is an element 
of the domain that tags tuples coming from [/] , whereas go tags tuples coming 
from [5]. We interpret / as a predicate that is true only on the element /o, and 
similarly g as a predicate true only on the element go. We then introduce the 
following dereferencing shorthand: 

IF = {HAF} (2) 

The expression If now denotes the original interpretation of/, that is, ft/] = fi- 
Moreover, t -1 / corresponds to field complement — /, and "fTrue corresponds to 



edges. Note that the expressions of the form t(— i f/\—ig) are now a l so avail- 
able. Let Bbca boolean combination of unary predicates denoting fields. These 
unary predicates are disjoint, so transforming B into disjunctive normal form 
and applying the property 

]{B 1 VB 2 ) = ]B 1 V}B 2 

which follows from (2), allows transforming ]B into a boolean combination of 
expressions of the form f / and tff- This means that we obtain no additional 
expressive power using expressions of the form ]B where B is a boolean combi- 
nation of unary predicates denoting fields, so for simplicity we do not consider 
such "ternary relation interpretation" further in this paper. 



5 Records and Inverse Records 

In this section we use role logic with spatial conjunction and field complement 
from Section 4 to introduce a notation for records. We also introduce inverse 
records, which are dual to records, and correspond to slot constraints in role 
analysis [33]. 



multifield: /Ai = card=°(-/ V (/ A -<A)) 

field: f^A= card s (A/\f) A f^+A 

s of the form —k, <k, or >k, for k 6 {0, 1, 2, . . .} 

multislot: A^f = card =0 (~-/ V (~/ A ^A)) 

slot: A<^f = card s (AA-/) A A A/ 

s of the form —k, <k, or >fc,for k £ {0, 1,2,.. .} 

A^f=A^f 

fm ::= field | multifield 
closedRecord ::= fm | closed Record ©fm 
openRecord ::— closedRecord ©True 

sm ::= slot | multislot 
closed I nvRecord ::= sm | closed I nvRecord © sm 
openlnvRecord ::— closed I nvRecord ©True 

Fig. 3. Record Notation 



Figure 3 presents the notation for records and inverse records. A field predi- 
cate / — ► A is true for an object whose only outgoing edge in the graph (model) is 
an /-edge terminating at A. Dually, a slot predicate A <— / is true for an object 
whose only incoming edge in the graph is an /-edge originating at A. A multifield 
predicate / — ► A is true iff the object has any number of outgoing /-edges termi- 
nating at A, and no other edges. Dually, a multislot predicate A <— / is true iff 
the object has any number of incoming /-edges originating from A, and no other 
edges. We also allow notation / — > A where s is an expression of the form =k, 
<k, or >k. This notation gives a bound on the number of outgoing edges, and 
implies that there are no other outgoing edges. We similarly introduce A <— /. A 
closed record is a spatial conjunction of fields and multifields. An open record is 
a spatial conjunction of a closed record with True. While a closed record allows 
only the listed fields, an open record allows any number of additional fields. In- 
verse records are dual to records, and we similarly distinguish open and closed 
inverse records. 

Example 6. To describe a closed record whose only fields are / and g where 
/-fields point to objects in the set A and g-fields point to objects in the set 
B, we use the predicate P\ = f — > A © g — > B. The definition of P\ lists all 
fields of the object. To specify an open record which certainly has fields / and g 
but may or may not have other fields, we write Pi = f — > A ® g — ► B © True. 
Neither Pi nor P^ restrict incoming references of an object. To specify that 
the only incoming references of an object are from the field h, we conjoin P2 
with the closed inverse record consisting of a single multislot True *— h, yielding 
the predicate P3 = P2 A True *— h. To specify that an object has exactly 
one incoming reference, and that the incoming reference is from the h field and 
originates from an object belonging to the set C, we use P4 = P2 A C <— h. 
Note that specifications P3 and P4 go beyond most standard type systems in 
their ability to specify the incoming (in addition to the outgoing) references of 
objects. 

6 Role Constraints 

Role constraints were introduced in [30,31,33]. In this section we show that role 
logic is a natural generalization of role constraints by giving a translation from 
role constraints to role logic. A logical view of role constraints is also suggested 
in [35,35]. A role is a set of objects that satisfy a conjunction of the following 
four kinds of constraints: field constraints, slot constraints, identities, acyclicities. 
In this paper we show that role logic naturally models field constraints, slot 
constraints, and identities. 1 

Roles describing complete sets of fields and slots. Figure 4 shows the 
translation of role constraints [33, Section 3] into role logic formulas. The sim- 
plicity of the translation is a consequence of the notation for records that we 
have developed in this paper. 



1 Acyclicities go beyond first-order logic because they involve non-local transitive closure 
properties. 



C[f ields F; slots S; identities 7; acyclic Aj = C\± ields F} A C[slots S] A 

[identities 7] A [acyclic Aj 

C[fields /i :Si,...,f„ :S„] = fi -* Si © ... ® f„^S„ 
C[slots5i./i,...,5„./„] = 5i^/i © ... © £„<-/„ 
[identities fi.gi, . . . , f n .g n ] = A"=i [/»=*• ~ff»] 

[acyclic /i, . . . , /„] = acyclic (V™ =1 /») 

Fig. 4. Translation of Role Constraints [33] into Role Logic Formulas 

0{f ields F; slots S; identities 7; acyclic A] = OJfields F] A ©[slots 5] A 

[identities 7] A [acyclic AJ 
©[fields fi:Si,...,f n :S n ]= C[f ields /i : Si, ...,/„: 5„] © card=°(VLi /*) 
C[ 5 i, . . . , 5m slots Si./i, . . . , 5 n ./„] = C[slots Si./i, . . . , S„./„] © card=°(V™ ! -<?*) 

Fig. 5. Translation of Simultaneous Role Constraints [33, Section 7.2] into Role Logic 
Formulas. See also Figure 4. 



Simultaneous Roles. In object-oriented programs, objects may participate 
in multiple data structures. The idea of simultaneous roles [33, Section 7.2] is 
to associate one role for the participation of an object in one data structure. 
When the object participates in multiple data structures, the object plays mul- 
tiple roles. Role logic naturally models simultaneous roles: each role is a unary 
predicate, and if an object satisfies multiple roles, the the object satisfies the 
conjunction of predicates. Figure 5 presents the translation of field and slot con- 
straints of simultaneous roles into role logic. Whereas the roles of [33, Section 
3] translate to closed records and closed inverse records, the simultaneous roles 
of [33, Section 7.2] translate specifications that are closer to open records and 
open inverse records. 



Eliminating Spatial Conjunction in RL 



Preserving the decidability. Previous sections have demonstrated the use- 
fulness of adding record concatenation in the form of spatial conjunction to our 
notation for generalized records. However, a key question remains: is the result- 
ing extended notation decidable? In this section we give an affirmative answer 
to this question by showing how to compute the spatial conjunction using the 
remaining logical operations for a large class of record specifications. 
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Approach. Consider two formulas F\ and F^ in first-order logic with counting, 
where both F\ and F% have quantifier depth one. An equivalent way of stating 
the condition on F± and F% is that there are no nested occurrences of quantifiers. 
(Note that we count one application of 3- k x. P as one quantifier, regardless of 
the value k.) We show that, under these conditions, the spatial conjunction 
F\ © F-z can be written as an equivalent formula F3 where F3 does not contain 
the spatial conjunction operation ©. The proof proceeds by writing formulas F\, 
F2 in a normal form, as a disjunction of counting stars [22], and showing that the 
spatial conjunction of counting stars is equivalent to a disjunction of counting 
stars. 

As a consequence of the results in this section, adding the operation © to 
logic with counting does not change its expressive power provided that both F\ 
and Fi have quantifier depth at most one. Here we allow F\ and F<i themselves 
to contain spatial conjunction, because we may eliminate spatial conjunction in 
F\ and F<i recursively. Applying these results to two- variable logic with counting 
C 2 , we conclude that introducing into C 2 the spatial conjunction of formulas 
of quantifier depth one preserves the decidability of C 2 . Furthermore, thanks to 
the translations between C 2 and RL in [36], if we allow the spatial conjunction 
of RL 2 formulas with no nested card occurrences, we preserve the decidability of 
the logic RL . The formulas of the resulting logic are given by 

F ::= A I / I EQ I Fi A F 2 \ ->F \ F' \ ~F | card^ fc F 

I Fi © F2, if F\ and F2 have no nested card occurrences 

Note that record specifications in Figure 3 contain no nested card occurrences, 
so joining them using © yields formulas in the decidable fragment. Hence, in 
addition to quantifiers and boolean operations, the resulting logic supports a 
generalization of record concatenation, and is still decidable; this decidability 
property is what we show in the sequel. We present the sketch of the proof, see 
Appendix for proof details.. 

7.1 Atomic Type Formulas 

In this section we introduce classes of formulas that correspond to the model- 
theoretic notion of atomic type [44, Page 20] (see [25, Page 42] and [12, Page 78] 
for the notion of type in general). We then introduce formulas that describe the 
notion of counting stars [22,45]. We conclude this section with Proposition 12, 
which gives the normal form for formulas of quantifier depth one. 

If C = C\, . . . , C m is a finite set of formulas, then a cube over C is a conjunc- 
tion of the form C" 1 A . . . C^™ where a* e {0, 1}, C 1 = C and C° = ->C. For 
simplicity, fix a finite language L = A U T with A a finite set of unary predicate 
symbols and T a finite set of binary predicate symbols. We work in predicate cal- 
culus with equality, and assume that the equality "=" , where = ^ !F, is present 
as a binary relation symbol, unless explicitly stated otherwise. We use D to 
denote a finite domain of interpretation and e to denote a model with variable 
assignment; e maps A to 2 D , maps T to 2 DxD and maps variables to elements 
of D. Let xi, . . . , x n be a finite list of distinct variables. Let C be the set of all 



11 



atomic formulas F such that FV(F) C {xi, . . . ,x n }. The set C is finite (in our 
case it has |„4|n+ {\T\ + l)n 2 elements). We call a cube over C a complete atomic 
type (CAT) formula. 

Example 7. If A = {A} and T = {/}, then 
A{x x ) A -<A(x2) A 

-^f(x 1 ,X 1 ) A ->f(X2,X2) A f(xi,X 2 ) A -1/(12,11) A 
Il=IlAl2=l2All/l2Al2/ X\ 

is a CAT formula. 

We may treat conjunction of literals as the set of literals, so we say that "a literal 
belongs to the conjunction" and apply set-theoretic operations on conjunctions 
of literals. 

From the disjunctive normal form theorem for propositional logic, we obtain 
the following Proposition 8. 

Proposition 8. Every quantifier-free formula F such that FV(F) C 
{xi, . . . , x n } is equivalent to a disjunction of CAT formulas C such that FV(C) = 

\X\ , . . . , X n f . 

A CAT formula may be contradictory if, for example, it contains the literal 
Xi ^ Xi as a conjunct. We next define classes of CAT formulas that are satisfiablc 
in the presence of equality. Let x\, ■ ■ ■ ,x n be distinct variables. A general-case 
CAT (GCCAT) formula is a CAT formula F such that the following two condi- 
tions hold: 1) FV(F) = {xi, . . . , x n }; 2) for all 1 < i, j < n, the conjunct Xi = Xj 
is in F iff i = j. Let xi, . . . ,x n and j/i, . . . , y m be distinct variables. An equality 
CAT (EQCAT) formula is a formula of the form Afli Vj — x ij A F> where 
1 < ii, . . . , i m < n and F is a GCCAT formula such that FV(F) = {x\, . . . , x n }. 

Lemma 9. Every CAT formula F is either contradictory, or is equivalent to an 
EQCAT formula F' such that FV(F') = FV(F). 

From Proposition 8 and Lemma 9, we obtain the following Proposition 10. 

Proposition 10. Every quantifier-free formula F such that FV(_F) C 
{x\, . . . ,x n } can be written as a disjunction of EQCAT formulas C such that 
FV(C) = {a:i,..., s„}. 

We next introduce the notion of an extension of a GCCAT formula. Let 
x,xi, . . . ,x n be distinct variables and F be a GCCAT formula such that 
FV(F) = {xi, . . . ,x n }. We say that F' is an x-extension of F, and write 
F' E exts(F,x) iff all of the following conditions hold: 1) F A F' is a GCCAT 
formula; 2) F\/(F A F') = {x, x\, . . . , x n }; 3) F and F' have no common atomic 
formulas. Note that if FV(Fi) = F\/(F 2 ), then exts(Fi,x) — exts(F 2 ,x) i.e. the 
set of extensions of a GCCAT formula depends only on the free variables of the 
formula; we introduce additional notation exts(xi, . . . ,x n ,x) to denote exts(-F, x) 
forFV(f) = {n i n }. 
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To define a normal form for formulas of quantifier depth one, we introduce 
the notion of fc-counting star. If p > 2 is a non-negative integer, let p + be 
a new symbol which represents the co- finite set of integers {p,p + 1, . . .}. Let 
C p = {0, 1, . . . ,p— l,p + }. If c G C p , by 3 l x. P we mean 3 =l x. P if i is an integer, 
and 3- p x. P Hi = p + . We say that a formula F has a counting degree of at most 
p iff the only counting quantifiers in F are of the form 3 c x. G for some c G C p +\. 

Definition 11 (Counting Star Formula). Let x, x\, . . . , x n , and j/i, . . . , y m 
be distinct variables, k > 1 a positive integer, and F a GCC AT formula such 
that F\/(F) = {xi, . . . ,x n }. A fc-counting star function for F is a function 7 : 
exts(_F, x) — ► Cfe+i . A fc-counting-star formula for 7 is a formula of the form 

m 

f\y j =x l] A F A f\ 3'' (F,) x.F' 

j=l F'eexts(F,x) 

where 1 < i\, . . . , i m < n. 

Note that in Definition 11, formula A^Li Vj — x ij ^F is arL EQCAT formula, and 
formula AJli Vj — x i 3 A F A F' is an EQCAT formula for each F' G exts(F, x). 
The following Proposition 12 shows that formulas of quantifier depth at most 
one are equivalent to disjunctions of counting stars. 

Proposition 12 (Depth-One Normal Form). Let F be a formula of such 
that F has quantifier depth at most one, F has counting degree at most k, and 
FV(F) C {xi, . . . ,x n }. Then F is equivalent to a disjunction of k- counting- star 
formulas Fc where FV(i 7 c') = {x\, . . . , x n }. 

7.2 Spatial Conjunction of Stars 

Sketch of the construction. Let Fi and F-i be two formulas of quantifier depth 
at most one, and not containing the logical operation ©. By Proposition 12, let 
F\ be equivalent to the disjunction of counting star formulas V™=i ^M an d let 
F<i be equivalent to the disjunction of counting star formulas V?=iC2,j- By 
distributivity of law of © with respect to V, we have 

ni n 2 «i n 2 

F 1 ®F 2 ~ (\/ Ci,,) ®(\/ C 2 ,j) ~ V ^V Ci,i®C 2 ,i 

i=l 3 = 1 Z:=l J = l 

In the sequel we show that a spatial conjunction of counting-star formulas is 
either contradictory or is equivalent to a disjunction of counting star formulas. 
This suffices to eliminate spatial conjunction of formulas of quantifier depth at 
most one. Moreover, if F is any formula of quantifier depth at most one, possibly 
containing ©, by repeated elimination of the innermost © we obtain a formula 
without ©. 

To compute the spatial conjunction of counting stars we establish an alter- 
native syntactic form for counting star formulas. The idea of this alternative 
form is roughly to replace a counting quantifier such as 3 =k x. F' with a spatial 
conjunction of fc formulas each of which has the meaning similar to 3 =1 x. F' , and 



13 



then combine a formula 3 =l x. F[ resulting from one counting star with a formula 
3 =1 x. F' 2 resulting from another counting star into the formula 3 =1 x. (F[ F^) 
where denotes merging of GCCAT formulas by taking the union of their pos- 
itive literals. We next develop this idea in greater detail. 

Notation for spatial representation of stars. Let Ge(x\, . . . ,x n ) be the 
unique GCCAT formula F with FV(F) = {x\, . . . , x n } such that the only positive 
literals in F are literals Xi — Xi for 1 < i < n. Similarly, there is a unique formula 
F' G exts(xi, . . . ,x ni x) such that every atomic formula in F' distinct from for 
x = x occurs in a negated literal. We call F' an empty extension and denote it 
empEx(xi, . . . , x n ,x). 

To compute a spatial conjunction of formulas C\ and C^ in the language L, 
we temporarily consider formulas in an extended language L' — L U {B\, Bi\ 
where B\ and Bi are two new unary predicates used to mark formulas. We use 
B\ to mark formulas derived from C\ , and use Bi to mark formulas derived from 
C 2 . For m G {0, {1}, {2}, {1, 2}}, define 

Mark (x) = -.Si (a;) A -<B 2 {x) Marki(x) = Si(cc) A ->B 2 (x) 
Mark 2 (;E) = -nSi(cc) A B 2 (x) Marki, 2 (x) = Si(x) A B 2 (x) 

Note that, when we say that F is a GCCAT formula, we mean that F is GCCAT 
formula in language L (and thus F mentions symbols only from L), even when 
we use F as a subformula of a larger formula in language L' . Similarly, expres- 
sions exts(xi, . . . , x n , x), empEx(F, x), and Ge{x\, ..., x n ) all denote formulas in 
language L. 

On the other hand, empEx0(i' 1 , x) and empe are formulas in language V . 
Formula empEx0(F, x) is an empty extension of F in language L'. Formula empe 
asserts that xi, . . . , x n have an empty GCCAT formula and that the remaining 
elements have empty extension in L' . Formula empe does not constrain the values 
B\{xi) and B2(xi), these values turn out to be irrelevant. 
Let F' 6 exts(xi , . . . , x n , x). Define 

empEx0(;ri, . . . , x n ,x) = empEx(:ri, . . . ,x n ,x) A Mark0(a;) 

empe(xi, . . . ,x n ) = Ge{xi,. ■ ■ ,x„) A Vx. (A"=i x ^ Xi ) =^ empEx (xi, ... ,x n ,x) 

We write empEx (F, x) for empEx (xi, . . . ,x n ,x) if FV(F) = {xi, . . . ,x„}, and 
similarly for empe(F, x). We write simply empe if F and x are understood. 

We next introduce formulas (j-F'Dm and (\F'\) m , which are the building blocks 
for representing counting star formulas. Formula (j-F'D^ means that F' marked 
with m and empExg j (F, x) are the only extensions of F that hold in the neigh- 
borhood of xi,...,x n (F' may hold for any number of neighbors). Formula 
d-F"D m means that F' holds for exactly one element in the neighborhood of 
xi, . . . ,x„, and all other neighbors have empty extensions. More precisely, let 
F' G exts(xi, . . . , x n , x). Define 

(\F'f m = G E {xi,...,x n ) A Vx. (A"=i a # au) =** (F'AMark m (x)) VempEx (F,x) 
t\F'\) m = t\Fy m A 3 =1 x. t\ i=1 X±Xi A F'AMark m (:r) 



wherem G {0,{1}, {2}, {1,2}}. Observe that G® empe - G if G = f\F 
G = <\F'\) m for some F' and m. Also note that <\F'^ m ®(\F'[,* m - <\F'\)* r 
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EAF- EQCAT formula 
F - GCCAT formula 

SmlE/\F/\3 sl x.F{ A... A3 Sk x.Fi] = 
= E A K[F\®X m \3 ,1 x.F[\®...®X m ^"'x.H] 

K\F\ = F A ^-.(ALi^/^O^empEx^F,^)) 

# m [3°a:.F'] = empe 

A^p'+VF'] = (FVs^pa;.?'] 

X m \^ + x.F'} ^X m px.F'}®l\Fy m 

Fig. 6. Translation of Counting Stars to Spatial Notation 



Translation of counting stars. Figure 6 presents the translation of counting 
stars to spatial notation. The idea of the translation is to replace 3 =k x. F' with 
the spatial conjunction of k formulas (\F'\) m ® . . . ®(\F'\) m where m G {{1}, {2}}. 
The purpose of the marker m is to ensure that each of the k witnesses for x that 
are guaranteed to exist by d-F'Dm © • • • ©d-F'Dm are distinct. The reason that the 
witnesses are distinct for m ^ is that no two of them can satisfy Bi{x) at the 
same time for i G m. 

To show the correctness of the translation in Figure 6, define e m to be the 
L'-environment obtained by extending L-environment e according to marking 
m, and eT to be the restriction of an V environment e\ to language L. More 
precisely, if e is an environment in language L, for m G {0,{1},{2},{1,2}}, 
define environment e m in language V by 1) e m r — er for r G L and 2) for 
q G {1,2}, let (eB q )d = True -£=>■ q G m A d fi {exi, ..., ex n }. Conversely, 
if ei is an environment in language V ', define environment el in language L by 
eir = ei r for all r G L. Lemma 13 below gives the correctness criterion for 
translation in Figure 6. 



Lemma 13. If e is an environment for language L, C a counting star formula 
m language L, and m G {{!}, {2}, {1, 2}}, then [C]e = S m \C]e m . 



(1) (P\Pi®(|T 2 p 2 -N*(|Ti©T 2 pi, a 

(2) <p\Di ®dT 2 |)| ~» (|Ti r 2 pi, a ©^2 

(3) dTiDI ©dT 2 |) 2 ~» flTiDI ®t\Tr T 2 |h, 2 

(4) dTiPJ ®dr 2 D5 ~» JTiDI ©{IT2D2 ®<pi T 2 Di, 2 

(5) drDI «~ empe 

(6) ^2 — empe 

Fig. 7. Transformation Rules for Combining Spatial Conjuncts 
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Combining quantifier-free formulas. Let C\ ©C 2 be a spatial conjunction 
of two counting-star formulas 

Ci = E A Fi A 3 sl ^a;.Fi ;1 A ... A 3 Sl - k x.F{ :k 
C 2 =E AF 2 A l^x.Fii A ... A 3 S2 - k x.F(t 

where F x and F 2 are GCCAT formulas with FV(iq) = FV(F 2 ) = {aq, . . .,x n }, 
E A Fi and E A F 2 arc EQCAT formulas, and E = /\™ =1 j/j = x i} . 

Note that we assume that the two GCCAT formulas F\ and F 2 have same 
free variables and that the equalities E in the two EQCAT formulas are the 
same. This assumption is justified because either 1) C\ ®C 2 make inconsistent 
assumptions about equalities among aq, . . . , x n , and therefore C\ © C 2 is equiv- 
alent to False, or 2) Ci©C 2 make same assumptions about equalities among 
Xi, . . . ,x n , so we can rewrite C\ and C 2 to satisfy the our assumption by ex- 
changing variables Xi and yj in the definition of an EQCAT formula. 

To show how to transform formula S\ [Ci] © <S 2 [C 2 ] into a disjunction of 
formulas of the form £1,2 [C3], we introduce the following notation. If T is a 
formula, let S(T) denote the set of positive literals in T± that do not contain 
equality. Let T\ e exts(F\,x) and T 2 € exts(F 2 ,x). (Note that exts(Fi,a;) = 
exts(F 2 ,x).) We define the partial operation T\ T2 as follows. The result of 
7\ T 2 is defined iff S{T Y ) n S(T 2 ) = 0. If S(Ti) n S(T 2 ) = 0, then T 1 &T 2 =T 
where T is the unique element of exts(iq, ai) such that S(T) = S(Ti) U S(T 2 ). 
Similarly to 0, we define the partial operation F\ © F 2 for F\ and F 2 GCCAT 
formulas with FV(Fi) = FV(F 2 ) ={xi,..., x„}. The result of iq © F 2 is defined 
iff 5(Fi) n S(F 2 ) = 0. If 5(Fi) n S(F 2 ) = 0, then iq © F 2 is the unique GCCAT 
formula F such that FV(F) = {xi,...,x n } and 5(F) = S(iq) U S(F 2 ). The 
following Lemma 14 notes that and © are sound rules for computing spatial 
conjunction of certain quantifier-free formulas. 

Lemma 14. IfT ll T 2 e exts(aq , . . . , x n , x) then T X ®T 2 - T x T 2 . // F x a^rf 
F 2 are GCCAT formulas with FV(iq) = FV(F 2 ) = {xi, . . . , x„} 7 tten Fi © F 2 - 

F!©F 2 . 

Rules for transforming spatial conjuncts. We transform formula 

<Si[Ci] ©5 2 [C 2 ] into a disjunction of formulas of the form tSi. 2 [C3] as follows. 

The first step in transforming Ci©C 2 is to replace /C[Fi] ©/C[F 2 ] with 
/C[Fi © F 2 ] if Fi © F 2 is defined, or False if F x © F 2 is not defined. 

The second step is summarized in Figure 7, which presents rules for com- 
bining conjuncts resulting from ,*i[3 Sl .Fi] and A" 2 p S2 a;.F 2 ] into conjuncts of 
the form Afi. 2 [3 s a;.F]. The intuition is that flT^ and <\T\) m represent a finite 
abstraction of all possible neighborhoods of aq, . . . , x n , and the rules in Figure 7 
represent the ways in which different portions of the neighborhoods combine us- 
ing spatial conjunction. We apply the rules in Figure 7 modulo commutativity 
and associativity of ©, the fact that emp is a unit for ©, as well as the idempo- 
tence of (jrp^. Rules (1) — (4) are applicable only when the occurrence of T\ T 2 
on the right-hand side of the rule is defined. We apply rules (1) — (4) as long as 
possible, and then apply rules (5), (6). Moreover, we only allow the sequences of 
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rule applications that eliminate all occurrences of (|T[)i, f\T\)l, f\T\)2, (\T\)2, leaving 
only dT|)i.2 and (\T\)l 2 . Note also that the are only finitely many non-equivalent 
expressions that can be obtained by sequences of applications of rules in Fig- 
ure 7. Namely, an application of rules (l)-(3) decreases the total number of 
spatial conjuncts of the form <\T\ji and (\T\)2, multiple applications of rule (4) to 
the same pair of spatial conjuncts are unnecessary because of the idempotence 
of (|Ti 0T2D5; 2 (so we never perform them), and rules (5), (6) reduce the total 
number of spatial conjuncts. The following Lemma 15 gives partial correctness 
of rules in Figure 7. 

Lemma 15. If Gi ~> G2, then G2 =>■ G\ is valid. 

Define G\ => G2 to hold iff both of the following two conditions hold: 1) 
G 2 results from d by replacing /C[Fi] ®/C[F 2 J with K{F X © F 2 ] if F x © F 2 is 
defined, or False if F\ © F 2 is not defined, and then applying some sequence of 
rules in Figure 7 such that rules (5), (6) are applied only when rules (1) — (4) 
are not applicable; 2) G2 contains only spatial conjuncts of the form dTDi^ an d 
flTDi 2- From Lemma 15 and Lemma 14 we immediately obtain Lemma 16. 

Q 

Lemma 16. If G\ =^>G2, then G2 => G\ is valid. 

The rule for computing the spatial conjunction of counting star formulas is the 
following. If C\, C2, and C3 are counting star formulas, define TZ(C\, C2, C3) to 

hold iff <Si [Ci] © S2 [C2] ==>■ iSi,2 [C3] . We compute spatial conjunction by replac- 
ing C\ © C2 with Vk(c c C ) ^3- ^ ur S oa ^ ^ s therefore to show the equivalence 

Ci©C* 2 V C 3 (3) 

K(C 1 ,C 2 ,C 3 ) 

The validity of Vk(c c c ) ^3 ^ (Ci©C2) follows from Lemma 16 and 
Lemma 13. 

Lemma 17. (Vkcc c c ) ^ 3 ) ^ i^ 1 ®^) is a valid formula for every pair of 
counting star formulas C\ and C2 ■ 

We next consider the converse claim. If \C\ © C^Je, then there are e\ and e2 such 
that spliteeie2, [Cijei, and [C2]e2- By considering the atomic types induced 
in e, ei and e2 by elements in D \ {exi, . . . ,ex n }, we construct a sequence 
of ~> transformations in Figure 7 that convert <Si[Ci] ©^I^] into a formula 
<Si,2[C3] such that [C 3 ]e = True. 

Lemma 18. C\ ©C2 =>■ \J-jztc c c ) ^ 3 * s a va ^ formula for every pair of 
counting star formulas C\ and C2 ■ 

From Lemma 17 and Lemma 18 we obtain the desired Theorem 19, which 
shows the correctness of our rules for computing spatial conjunction of formulas 
of quantifier depth at most one. 

Theorem 19. The equivalence (3) holds for every pair of counting star formulas 
C\ and C2. 
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8 Further Remarks 

In this section we present two additional remarks regarding spatial conjunction. 
The first remark notes that we must be careful when extracting a subformula 
from a formula and labelling it with a new predicate. The second remark shows 
how to encode spatial conjunction in second-order logic, thus providing some 
insight into the expressive power of spatial conjunction. 

8.1 Extracting Subformulas in the Presence of © 

In two- variable logic with counting C 2 we may efficiently transform formula into 
an unnested form by introducing new predicate names and naming subformulas 
using these predicates. This transformations is a standard step in decidability 
proofs for two- variable logic with counting [22,45]. 

The satisfiability of the resulting formula is equivalent to the satisfiability of 
the original formula. An extraction of a subformula G and its replacement with 
a new predicate P can be justified by a substitution lemma of the form: 

lF[P:=G]\e = {F\(e[P:={G\e]) 

where e is the environment (model). This substitution lemma does not hold in 
the presence of spatial conjunction that splits the values of newly introduced 
predicates. Namely, 

l(Fi®F 2 )[P:=G}]e =» [F x ®F 2 ](e[P := [G]e]) 

holds, but the converse implication does not hold because the value [G]e of the 
relation P might be split on the right-hand side. 

It is therefore interesting to divide predicates into splittable and non-splittable 
predicates, and have spatial conjunction split only the interpretations of split- 
table predicates. The substitution lemma then holds when P is a non-splittable 
predicate. 

Note, however, that in the presence of non-splittable predicates we cannot 
translate counting stars into spatial notation and thus use unnested form to 
eliminate all spatial conjunctions from first-order formulas. As a result, adding 
spatial conjunction of formulas of large quantifier depth to two-variable logic 
with counting may increase the expressive power of the resulting logic. 

We also remark that if the language contains only one splittable unary predi- 
cate As, then it is easy to simulate the splitting of objects of the universe, which 
is the semantics of spatial conjunction in [28]. Namely, we use some fixed unary 
predicate Aq to denote all "live" objects, and make all quantifiers range only 
over the objects that satisfy Aq. 

8.2 Representing © in Second-Order Logic 

In this section we give a simple translation from the first-order logic with spatial 
conjunction and inductive definitions [27, Chapter 4] to second-order logic. This 



18 



gives an upper bound on the expressive power of first-order logic with spatial 
conjunction and inductive definitions. 

Consider first-order logic extended with the spatial conjunction © and the 
least-fixpoint operator. The syntax of the least-fixpoint operator is 

(\fpP,Xi,...,x n .F)(y 1 ,...,y n ) 

where F is a formula that may contain new free variables P, x\, . . . ,x n . The 
meaning of the least-fixpoint operator is that the relation which is the least 
fixpoint of the monotonic transformation on predicates 

(Axi,...,x„.P(xi,...,x„)) i-s- (\xi,...,x n .F) 

holds for yi, . . . ,y n . To ensure the monotonicity of the transformation on pred- 
icates, we require that P occurs only positively in F. 



A={A 1 ,...,A n } 

r = {fi,---,M 

lF'®F"j = 3A' 1 ,...,A' n ,f{,...,fL, 

A'{,...,K,fl',...,f^.B{F'®F"] 

B[F' © F"} = 

n m 

A (split, Ai K A'l) A /\ (split a fi fi fi') A 

[P][4i:=^i[/i:=kiA 
[F"][Ai := AfiU [fi^n'}T=i 
sp\\t 1 AA'A"=yx. (A(i)»(i'(i)vA"(i))) A 

^(A'(x)AA"{x)) 
split 2 / /' /" = Vz y. (f{x, y) «• (/'(*, y) V f"(x, y))) A 
-(/'(*,V) A /"(*>»)) 

[{WpP,xi,...,x n .F){y 1 ,...,y n )] = 

VP. (Vxi, ...,i„.(F# P(x u • • • , x n ))) =*- P(y u ■■■,y n ) 

Fig. 8. Translation of Spatial Conjunction and Inductive Definitions into Second-Order 
Logic 



Figure 8 presents the translation from first-order logic extended with spatial 
conjunction and least-fixpoint operator to second-order logic. The translation 
directly mimics the semantics of © and If p. 

In second-order logic, the relations in L = A U T become free variables. 
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To translate ©, use second-order quantification to assert the existence of 
new unary and binary relations that partition the relations in L into relations 
in L' and L" . Then perform a syntactic replacement of relations in L with the 
corresponding relations in L' for the first formula, and with the corresponding 
relations in L" for the second formula. 

Translating Ifp is also straightforward. The property that P is a fixpoint of 
F is easily expressible. To encode that yi, ■ ■ ■ ,y n hold for the least fixpoint of F, 
we state that yi, ■ ■ ■ ,y n hold for all fixpoints of F, using universal second-order 
quantification over P. 

We also note that the translation of © in Figure 8 uses only existential 
second-order quantification, which points to another class of formulas where 
spatial conjunction can be eliminated if we are only concerned with satisfiability. 
Namely, if F' and F" are first-order formulas (without © or Ifp), then F' ®F" 
is satisfiable iff the first-order formula B\F' ® F"\ in the extended language is 
satisfiable. As a slight generalization, define the following class of "interesting" 
formulas: 

1. a first-order formula F is an interesting formula; 

2. if Fi and F-i are interesting formulas, so is F\ ® F2; 

3. if Fi and F2 are interesting formulas, so is F\ V F<i 

The satisfiability of each interesting formula is equivalent to the satisfiability of 
the corresponding first-order formula in an extended vocabulary. In particular, 
the satisfiability of the class of formulas formed starting from formulas in two- 
variable logic with counting and applying only V and © is decidablc. 



9 Further Related Work 

Records have been studied in the context of functional and object-oriented pro- 
gramming languages [11,14,23,29,42,46-48,57]. The main difference between 
existing record notations and our system is that the interpretation of a record in 
our system is a predicate on an object, where an object is linked to other objects 
forming a graph, as opposed to being a type that denotes a value (with values 
typically rcprcscntable as finite trees). Our view is appropriate for programming 
languages such as Java and ML that can manipulate structures using destruc- 
tive updates. Our generalizations allow the developers to express both incoming 
and outgoing references of objects, and allow the developers to express typestate 
changes. 

We have developed role logic to provide a foundation for role analysis [30-33] . 
We have subsequently studied a simplification of role analysis constraints and 
showed a characterization of such constraints using formulas [34,35]. Multifields 
and multislots are present already in [32, Section 8.1]. In this section we have 
shown that role logic provides a unifying framework for all these constraints 
and goes beyond them in 1) being closed under the fundamental boolean logical 
operations, and, 2) being closed under spatial conjunction for an interesting class 
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of formulas. The view of roles as predicates is equivalent to the view of roles as 
sets and works well in the presence of data abstraction [39,40]. 

The parametric analysis based on there- valued logic was introduced in [53, 
54]. Other approaches to verifying shape invariants include [13,19-21,26,41]. A 
decidable logic for expressing connectivity properties of the heap was presented 
in [4]. We use spatial conjunction from separation logic that has been used for 
reasoning about the heap [7,8,28,51,52]. Description logics [1,6] share many 
of the properties of role logic and have been traditionally applied to knowledge 
bases. [9, 10] present doubly-exponential deterministic algorithms for reasoning 
about the satisfiability of expressive description logics over all structures and 
over finite structures. The decidability of two-variable logic with counting C 2 
was shown in [22], whereas [45] establishes the NEXPTIME-complexity of the 
satisfiability problem for the fragment C 2 with counting up to one. 

10 Conclusions 

We have shown how to add notation for records to two- variable role logic while 
preserving its decidability. The resulting notation supports a generalization of 
traditional records with record specifications that are closed under all boolean 
operations as well as record concatenation, allow the description of typestate 
properties, support inverse records, and capture the distinction between open 
and closed records. We believe that such an expressive and decidable notation is 
useful as an annotation language used with program analyses and type systems. 

Acknowledgements. We thank the participants of the Dagstuhl Seminar 
03101 "Reasoning about Shape" for useful discussions on separation logic and 
shape analysis. 
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A Appendix: Correctness of Spatial Conjunction 
Elimination 

Proposition 8. Every quantificr-frcc formula F such that FV(F) C {x\, . . . , x n } 
is equivalent to a disjunction of CAT formulas C such that FV(C) = {xi, . . . ,x n }. 

Proof. Let Fbea quantifier-free formula and FV(_F) C {xi, . . . , x n }. Transform 
F to disjunctive normal form F' . Let C be a conjunction in F' . If C contains 
a literal and its negation, then C is contradictory and we eliminate C from F' . 
Assume all conjunctions are non-contradictory, and let C be one conjunction. If 
there exists an atomic formula Fa in variables {xi, . . . ,x„} such that Fa £ C 
and (->Fa) £ C, then replace C with the disjunction 

(C* A F A ) V (C* A -<F A ) 

By repeating this process, we obtain a disjunction of CAT formulas. 

Lemma 9. Every CAT formula F is either contradictory, or is equivalent to an 
EQCAT formula F' such that FV(F') = FV(F). 

Proof. Let F be a CAT formula. If Xj ^ Xi occurs in F, then F is contradictory. 
If Xi = Xj occurs in F for % ^ j, then in all conjuncts other than Xi = Xj 
replace all occurrences of Xi with Xj. Repeat this process as long as it is possible. 
Suppose that the resulting formula was not established to be contradictory. Let 
yi , . . . , y m be variables that occur only on the left-hand side of some equality 
Hj = Xi . . Removing all equalities of the form yj = yj yields an EQCAT formula. 

Proposition 10. Every quantifier-free formula F such that FV(F) C 

{xi, . . . ,x„} can be written as a disjunction of EQCAT formulas C such that 
FV(C) = {si,..., *„}. 

Proof. Let F be a quantifier-free formula such that FV(F) C {xi, . . . , x„}. Using 
Proposition 8, transform F to disjunction of CAT formulas F\. Then, for each 
conjunct C of F\ apply Lemma 9 to transform C to an EQCAT formula. 

Proposition 12. Let F be a formula of such that F has quantifier depth 
at most one, F has counting degree at most k, and FV(F) C {xi,...,x„}. 
Then F is equivalent to a disjunction of fc-counting-star formulas Fq where 
FV(F C ) = {»!,...,»„}. 

Proof. Let F be a formula of such that F has quantifier depth at most one, F 
has counting degree at most k, and FV(F) C {xi, . . . , x„}. Then F is a boolean 
combination of 1) atomic formulas and 2) formulas of the form 3 s z. F' where F' 
is quantifier-free and FV(F') = {z,x\, . . . ,x„}. Because z is a bound variable, 
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rename it to x in each formula F' . Let F± be the result of transforming this 
boolean combination to disjunctive normal form. Consider a disjunct C of F\. 
As in the proof of Proposition 10, and treating quantified formulas as atomic 
syntactic entities, transform C into disjunction of formulas of the form 

m 

f\ yj = Wij A F A f\ {3^ F 'h.F') a{F ' ] 
j=i F'es 

where P(F') e C k+1 , a(F') e {0, 1} for F' <= S, and where Ajli Vj = Wj A F 
is an EQCAT formula with y\, . . . , y m , u>i, . . . , w p distinct variables such that 
{yi,---,y m ,wi,...,w p } = {xi,...,x n }, and FV(F' ) C {x,xi,. . . ,x n } for F' e 
5*. Here S is the set of formulas of the form 3^^ F ^x. F' that end up conjoined 
with the EQCAT formula as the result of transformation to normal form. By 
replacing each yj with Wi- in each F' , enforce that FV(F') C {x, w\, . . . , w p }. 
Using Proposition 10, transform each F' to a disjunction of EQCAT formulas. 
By applying the equivalences 



3^x. V B t r 


- V 


A 3- h x.B, 


1=1 


q 
Yl lj=ki 

3 = 1 


i=l 


3 = fcl X. V/ B % r 


- V 


A 3= h x.B,, 


i=l 


9 

J2 lj=ki 

3 = 1 


i=l 



for Bi, . . . ,B q mutually exclusive, and propagating the disjunction to the top 
level, ensure that every F' is an EQCAT formula. Then transform each term 
(=]/3(f ) x pi^a(F ) j n ^ p 0S jy ve boolean combination of formulas of one of the 
forms 3 =l x. F' for < i < k and 3- k+1 x. F' , using the properties 

-n3^ kl x.F' - V/ ^r l x.F' 

i=0 

-n3= kl x.F' - V/ 3= l x.F' \Z3^ k+1 x.F' 

i£{0,...M\{kl} 

Next ensure that each F' is not merely an EQCAT, but in fact a GCCAT such 
that F' £ exts(F,x), as follows. 

Suppose that F' contains a literal L\ complementary to some literal occurring 
in GCCAT formula F. If Li occurs in 3 =i x. F' for i > or in 3- k+1 x. F', then 
the entire conjunct is contradictory and we eliminate it. If L\ occurs in 3 =0 x. F 1 , 
then 3 =0 x. F' is implied by F, so eliminate it. Assume that F' has no literals 
complementary to literals in F. Then F' contains Wi ^ Wj for all i ^ j. Next 
ensure that i ^ Wj is a conjunct for 1 < i < p, as follows. Suppose that F' 
contains the conjunct x = Wi for some 1 < i < p. 

There is clearly at most one interpretation of x that is equal to interpretation 
of Wi, so if P(F') e {2, 3, . . . , k, (k + 1) } then F and F' are contradictory and 
the entire conjunction is False, so assume (3(F') G {0, 1}. For the same reason, 
3 =1 x. F' is equivalent to 3x.F', so if (3{F') = 1, then replace x with Wi in 
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F' giving a GCCAT formula F" such that FV(F") = FV(F). By definition of 
GCCAT formulas, either F and F" are equivalent, so F A (3x.F") ~ f, or F 
and -F" are contradictory, and the entire conjunction is False. 

Assume therefore that x ^ w% occurs in F' for all 1 < i < p. This means that 
F' is a GCCAT formula. Because FV(F') = {x, W\, . . . ,w p } and F 1 docs not 
contain a literal complementary to a literal from F, eliminating from F' atomic 
formulas that occur in F yields an element of exts(-F, x). 

To ensure that there exists exactly one conjunct of the form 3 s x. F' for each 
F' G exts(F, x), use the fact that the k + 1 formulas 3 =% x. F', for < i < k, and 
3- k+1 x. F' form a partition (they are mutually exclusive and their disjunction 
is True). 

Lemma 13. If e is an environment for language L, C a counting star formula 
in language L, and m G {{1}, {2}, {1, 2}}, then [C]e = S m [C\e m . 

Proof. Formula E contains only equalities, so \E\e iff [S]e m . It therefore suffices 
to show that 

{K{F\ ® X m {3 s 'x.F[\ © ... © X m l3 Sk x.F^]e m = True (4) 

iff [F]e = True and for all i, {3 Si x.F!je = True. 

=>): Let (4) hold. Then there exist eo, ei, . . . , eu such that split e m [eo e\ ■ . . e^], 
|/C[F]]c = True, and [T m p s <x.F/]]e, = True for 1 < % < k. 

We first show {Fje = True. Note first that [G^Jej = True for 1 < i < k. 
Namely, because both <\F'\j* n and <\F'\) m entail Ge, so does X m \3 St x.F[\, by 
definition of X m ^\ and split. Therefore, eo is the only environment among 
erj,ei,...,efc that may have non-empty relations between the elements inter- 
preting xi,...,x„. As a result, [F]e m = [F]eo. But [F]eo = True because 
[/CjFjJeo = True. Therefore [F]e m = True, and F contains no symbols from 
L'\L, so [F]e = True. 

We next show \3 Si x.F[\e = True for 1 < i < k. For Sj = p + , from 
[<T m [3 Si x.F/]]ei = True we have that there exist ej ; o,ej ; i, . . . , ej ;P such that 
1) splite 4 [e^o,e l4 ,...,e^p], 2) IflF'D^Je^o = True, and 3) [(.F'DmJKj = True 
for 1 < j ' < p. Similarly, for Sj < p, we have that there exist e^i, . . . , ej )Si 
such that 1) splitei[ei ; i, . . . ,ei jS J, and 2) [d-F'Dm]eij = True for 1 < j < Si. 
Note that whenever [(j-F'D^Jeij or [d-F'DmJ e i,j holds, we can split elements of 
the domain D into two disjoint sets: elements Eij for which empEx0(_F, x) 
holds, and elements Nij for which F' A Mark m (x) holds. If [d-F"Dm]ej,j, then 
\Nij\ = 1, by definition of [fl.F'Dm]eij. Moreover, by definition of split and 
because m ^ 0, we have N 1 j 1 n N 2 j 2 = for {i\,j\) ^ («2,j2)- Observe 
that, for a given domain clement d G D, the atomic type extension correspond- 
ing to e m with i m d is the union of atomic type extensions corresponding 
to each eij. The atomic type extension for d in aj is either F' A Mark m (x), 
or empEx0(i 7 ', x). Therefore, the atomic type extension for d in e m is either 
F' A Mark m (x) if d G Nij for some i,j, or empEx0(F,x) if for all i,j, d £■ iVjj. 
If 7V 4 = {d | \F[\e m [x ^ d] = True}', then TV; = ty N t j. If s 4 = k < p then 

Wi\ = Ej-U \ N i,j\ = E2=j ! = s *> so P= fc x.F/]e m = True. Because 3= fe x. F/ 
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is formula in language L, we have [3 k x.F[\e = True. Similarly, if s, = p + , 
then \Ni\ = \N it0 \ + £j? =1 \N itj \ = |JV ii0 | + P > p, so [3^ fc x.F/]e m = True and 
therefore J3- P x. F/]e = True. In both cases, [3 Si x. F/]e = True. 

This completes one direction of the implication, we next show the converse 
direction. 

<=): Let {Fje = True and for all i where 1 < i < k, p^x.F/Je = True. 
We construct environments eo, e\, . . . , eh such that 1) split e m [eo, ei, . . . , e/t] 2) 
[/C[F]]e = True, and 3) [<Y m [3 s *a;.i^]]ei = True for all i where 1 < i < k. 
We construct eo,ei, . . . ,e^ by assigning the tuples of relations in e to one of 
the environments eo, ei, . . . , ej,, as follows. We only need to decide on splitting 
the tuples (di, . . . , d q ) where all but one value di, . . . , d q are from the set Dx = 
{exi, . . . , ex„}, the values of relations on other tuples do not affect the truth 
value of formulas in question and can be split arbitrarily. If {di, . . . , d q } C Dx, 
then we assign the tuple to eo, as a result, |/C[F]]eo = True. If {d\, . . . 7 d q }\Dx = 
{d}, then let i be such that F- is the unique extension of F with the property 
[F/]e[x h^ d] = True. Then assign the tuple (di, . . . , d q ) to the environment e% 
and also assign the values (eF>i)d for all I £ m to ej. Because we assign each 
relevant tuple to exactly one ej, we ensure splite" 1 [e , ei, . . . , e^]. Let De = {d 
[F/]e[x h^ d] = True}, then also De — {d \ [F/]ej[x i-> d] = True}. Because 
[3 Si x.F/]e = True, \De\ = Si for s, < p and |D_e| > P for s^ = p + . Let Sj < p. 
Then split e; into e^i, . . . , ej jSi by assigning exactly one element d £ De to one 
eij. When assigning an element we assign the values of all relations from L, as 
well as the relations B\ and B 2 - This ensures that [d-F/Dmleij = True for all 
1 < i < Si. For Si = p + , we split ei into e^o, e^i, . . . , e^ p by assigning exactly 
one element to each of e^i, . . . , ej )P and assigning the remaining elements to e^o- 
In both cases, we obtain [<Y m [3 Si x.F/]]ei = True. 

Lemma 15. If G\ ~> G2, then G2 => G\ is valid. 

Proof. We show the claim for each of the rules (l)-(6). 

Rule (1): Let T x T 2 be defined and let [flTi 0T 2 | li2 ]e = True for an V- 
environment e. Let d £ D be the unique domain element such that [Ti0T2]e[x 1— > 
d] = True. Let e\ and e-i be such that splite [ei,e2], [Ti]ei[x h^ d] = True and 
[T , 2]e2[x ^^ d] = True, and e p B q d = True iff p = q for p, q £ {1,2}. In other 
words, ei and e 2 split e by assigning tuples validating T\ to ei, tuples validating 
Ti to e2, and by assigning B\ to e\ and Bi to e2 on the element d. The values 
of relations e r containing tuples with an element d' ^ {exi, . . . , ex n , d} are all 
False, because [(pi T^Di^Je = True, so we let the values of eir and e 2 r for those 
tuples also be empty. Then d is the only element outside {ex\, . . . , ex n } such that 
Pi]ei[x h^ d] = True, and d is also the only element outside {exi, . . . , ex„} such 
that [T 2 ]e 2 [x ^ d] = True. As a result, [(|Ti[)i]ei = True and [(^[h]^ = True, 
so [OTiDi ®dT 2 D 2 ]e = True. 

To show the claim for rules (2), (3), (4), we proceed similarly as for rule (1). 

Rule (2): Let 7\ T 2 be defined and let [flTi 0T 2 |i, 2 ©^D^e = True. 
Then there are e! and e" such that splite [e', e"], (<\Ti 0T 2 Di i2 ]e / = True and 
[dT 2 |)2]e" = True. Let d be the unique clement such that pi T 2 ]e'[x 1-+ 
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d] = True, and let d\,...,dk be the list of all (distinct) elements such that 
[dT 2 [)2]e"[x h^ di] = True. Note that d <£ {di,...,dk}, because e'B 2 d = True, 
e" ' B 2 di = True for all 1 < i < k, and split e [e 1 , e"]. We construct e\ and e 2 such 
that split e [ei, e 2 ] as follows. We assign B\, as well as the values of relations that 
hold according to T\ on element d to e\, and we assign B 2 , as well as the values 
of relations that hold according to T 2 on element d to e 2 . We assign B 2 as well as 
the values of relations that hold according to T 2 on di, . . . , dk to e 2 . The values 
of B\ and the relations on d±, . . . ,dk for e\ are empty. For such e\ and e 2 we 
have HTiDijei = True and \(\T 2 )* 2 }e 2 = True, so [flTiDi ®(\T 2 \)*je = True. 

Rule (3) is analogous to rule (2). 

Rule (4): Let I\ &T 2 be defined and let [flTiDJ ®<\T 2 \)^ ®(\T 1 T 2 \)* 12 } = True. 
Then there are e',e",e'" such that split e[e',e",e'"], [(JTiDlJe' = True, ^T 2 |)^]e" = 
True, and [(|7i T 2 D 12 ]e'" = True. Then there are three sets of elements N', N" , 
N"', where N' contains elements that validate T\ in e', N" contains elements 
that validate T 2 in e", and N'" contains elements that validate T\ T 2 in e"'. 
We have N' n N"' = and AT" n AT"' = 0, whereas N' n A/ 7 ' need not be 
empty. Each element d £ {ex\, . . . , ex n } validates in e either 1) empEx^(F, x), if 
d^ iV'UiV"U^ / ",or2) Ti.ifdG N'\N", or 3) T 2 , if d G N"\N', or 4) Ti0T 2 , 
if d G (AT'n AT") U A 7 "'". We construct environments ei,e 2 ,es by assigning 73i and 
relations from T\ to elements in N' \ N" to ei, assigning _B 2 and elements in 
AT' \ A/ 7 ' to e 2 , and splitting relations on elements in (N' nJV")U N'" into those 
for Ti, which we assign to ei, and those for T 2 , which we assign to e 2 . We then 
have IdTiDilei = True and [M]e 2 = True, so p^f ®flT 2 ^] - True. 

Rules (5), (6): Directly from the dehnitions of empe and d-^'Dm it follows that 
empe =► flF'^. 

Lemma 17. (Vk(c c c ) ^ 3 ) ^ (^ ® C2) is a valid formula for every pair of 
counting star formulas C\ and C 2 . 

Proof. Let [V75.cc c c 1 ^3l e bold for some L-environmcnt e. Then [C^e = 

True for some C3 such that <Si[Ci] © <5 2 [C 2 ] =^ S\^ 2 \C^\. By Lemma 16, 
5i. 2 [C3] => <Si[Ci] ®>S 2 [C 2 ] is valid. By Lemma 13 and \C$\e = True, we have 
[Si.alCaHe 1 - 2 = True. Therefore, [5i[Ci] ®5 2 [C , 2 ]]e 1 ' 2 = True. This means 
that there are e\ and e 2 such that split e 1 ' 2 [ei, e 2 ], [<Si[Ci]]ei = True, and 
[5 2 [C 2 ]]e 2 = True. From Lemma 13 we have [Ci]eT = True, and J^Jei' = True. 
From split e 1,2 [ei,e 2 ] it follows that splite [e7, ei], so \C\ ®C 2 ]e = True. 

Lemma 18. C\ ® C 2 =>• \l n(c C c ) ^3 ^ s a va bd formula for every pair of 
counting star formulas C\ and C 2 . 

Proof. Let \C\ ® C 2 ]e = True for some L-environmcnt e. Then there are e\ and 
e 2 such that splite [ei,e 2 ], [Ci]ei = True and [C 2 ]e 2 = True. By Lemma 13, 
<Si[Ci]e} = True and tS 2 [C 2 ]e 2 = True. We construct <Si i2 [C3] such that 

Sild] ®<S 2 [C 2 ] =^5i, 2 [C 3 ] and [C 3 ]e - True, as follows. 

Let K x be the GCCAT part of C x and let K 2 be the GCCAT part of C 2 . Let 
Dx = D\{exi, . . . ,ex n }. For each d G Dx, let Tf be the type extension induced 
by din a, that is, let Tf G exts(K\,x) be the formula such that [TflejLi h^ d] = 
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True. Similarly, let T$ £ exts(K2,x) be the formula such that [T^le^x >—> d] = 
True. Because split e [ei, e 2 ], the operation Ti0T 2 is defined and [TiQiye 1 ' 2 ^ >— ► 
d] = True. Because iSi[Ci]ej = True, with each d we can associate an occurrence 
//i(d) in <Si[Ci] of a formula F^m^, where F^i^ is of the form <\Tfty\ or of the 
form fllfD*, and an environment ei iMl (<j) such that split e\ [ei,o, (ei, Ml (d)) A »(d)], 
such that /CJifiJe^o = True, and such that for every d, [■P) tl (d)]ei )/il (d) = True. 
Analogously, for each d we can associate an occurrence // 2 (d) in <S 2 [C 2 ] of a 
formula i^ 2 (<j) of the form d^th or of the form (p^D^, and an environment 
e2, M2 (d) such that split e^ [e 2 ,o, (e 2 , M2 (d)) M2 (d)], such that £|[.fir 2 ]e 2j o = True, and 
such that for every d, [^ 2 (d)]e 2 ^ 2 (d) = True. 

We compute C 3 by first combining /C[i^i] and K\K 2 \ into K.[K 1 © K 2 \. 
From split e [ei, 62] we conclude that the operation Fi © F 2 is well-defined and 
that \K\F\ © F 2 ]]e ' = True where e ' is given by split e ' [ei,o, e 2 ,o]- 

We next apply rules (l)-(4) in Figure 7, as follows: 

1. apply rule (1) once to each pair of occurrences //i(d) and // 2 (d) if they are 
of the form i\Tf\)i and (\T2\j2, respectively; let //(d) be the occurrence of the 
resulting formula F„ (d) = (\T? T^ lX , 

2. apply rule (2) once to each pair of occurrences //i(d) and // 2 (d) if //i(d) is an 
occurrence of the form <\Tfty\ and //2(d) is an occurrence of the form dT^; 
let //(d) be the occurrence of the formula F^) — d^f* © ^lfDi,2 obtained as 
one of the results; 

3. apply rule (3) once to each pair of occurrences //i(d) and // 2 (d) if //i(d) is an 
occurrence of the form (piD* and // 2 (d) is an occurrence of the form (P2D2; 
let //(d) be the occurrence of the formula F^r d \ = <\Tf T 2 )\,2 obtained as 
one of the results; 

4. apply rule (4) once for each pair of occurrences of formulas of the form d^YDi 
and d^D 2 ; f° r eacn ^ suc h that /*i(d) is an occurrence of (jT^D* an d /42(d) is 
an occurrence of (X^)^, l°t A*(^) be the occurrence of the resulting formula 

Note that no rule is applied twice to a distinct pair of occurrences of formulas. 
This means that the number of applications of rules is uniformly bounded, de- 
spite the fact that there is no bound on the size of the model e. In particular, 
there is no bound on the number of elements d covered by a single application 
of rule (4). Each formula of the form flT[)i is F^m) f° r some d and each formula 
of the form <\T\)2 is -F)i 2 (d) f° r some d, and all such formulas are consumed by 
applications of rules (l)-(3), so the resulting formula has no subformulas of the 
form d^Di or <\T\)2- After applying rules (l)-(4), apply rules (5) and (6) to all 
applicable formulas. The resulting formula Fr has no occurrences of (|TDi or 
(JTD2 either, it contains only occurrences of formulas of forms dT|)i. 2 and d^Di 2 - 
For each of the finitely many occurrences //(d) in Fr we construct e ',.-,, 

splitting e 1 ' 2 into the environment e ' defined above, and the environments 
e ',„, by assigning the type extension of d in e 1 ' 2 to e ',.-,. By construction, 

split e 1,2 [e ' , (e '( d ))/j,(d)]- To show [Fije 1 ' 2 = True, it suffices to show 

[Fje*' 2 = True (5) 
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for every occurrence c = fJ,(do). Fix an occurrence c, and let 5 = {d ^(d) = c}. 
By definition of el' 2 , the type extension induced by each d G 6 in ej' 2 is TfoT^, 
and the type extension of each d £ Dx \ <5 is an empty extension. Therefore, 
[flTfoT^aleJ' 2 = True. If F c = JT/gT^ then the equation (5) already 
holds. If F c = <\Tf T 2 d t)i,2, then F c was generated by one of the rules (l)-(3), 
which means that 6 is a singleton set. Namely if F c was generated by rules (1) or 
(2), then there is exactly one d such that /ii(<i) = c, namely do, and similarly if F c 
was generated by rule (3), then there is exactly one d such that /42(d) = c , again 
do- In both cases, <5 = {do}> so do is the unique d with type extension T^ T$ , 
which means that [dT-f T^i^J^l' 2 — True and the equation (5) holds. 

We finally apply idempotence to ensure that no dT^ occurs more than 
once. The resulting formula F' R is equivalent to Fr, so [i^Je 1 ' 2 = True, F' R 

is of the form S ll2 [C 3 ], and 5i[Ci] ®«S 2 [C 2 ] =^,S 1)2 [[Cy. From S ll2 [C 3 ] we 
recover C3 using the inverse of the translation in Figure 6. By Lemma 13 we 
have [Cye = True, completing the proof. 
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